domma-cms 0.104.1 → 0.105.0

package/server/routes/api/calls.js

@@ -0,0 +1,134 @@
+/**
+ * Instant calls - /api/calls (services/instantCalls.js)
+ *
+ * Every route here answers 404 until a Pro Tool with calls (Booking Pro,
+ * Contacts Pro, Calendar) has switched instant calls on - a free site has none -
+ * and again the moment the last one is disabled.
+ *
+ * Signed in, `calls` permission:
+ *   GET  /api/calls/status              {mailReady, contacts}                                   (calls.create)
+ *   GET  /api/calls/contacts?q=         contacts the caller may READ (own + shared), to pick     (calls.create)
+ *   GET  /api/calls/contact/:id         one contact the caller may read, to fill in             (calls.create)
+ *   POST /api/calls                     {name, email?, contactId?, notify} -> 201 {id, hostUrl, joinUrl, emailed, emailLimited?, expiresAt}
+ *   GET  /api/calls?contact=<id>        the caller's recent calls with that contact             (calls.read)
+ *
+ * Contacts are read through `readableContactIds` (services/hooks.js): the
+ * caller's own, plus whatever a sharing plugin (Contacts Pro) lets them read -
+ * its rule, not a copy of it. Reading contacts also needs Contacts on and the
+ * `contacts.read` permission.
+ *
+ * Limits on POST: 20 a minute per address (the route), CREATES_PER_MINUTE per
+ * user, and EMAILS_PER_ADDRESS_HOUR emails to any one recipient - past that the
+ * call is still made, with `emailed: false, emailLimited: true`.
+ *
+ * The call itself (no sign-in - the link is the credential):
+ *   /api/calls/room/:id/{join,poll,signal,chat,answer,recording,leave}   (plugins/_lib/call/routes.js)
+ *   join takes {t} (the guest) or {h} (the host); guests knock and the host lets them in.
+ */
+import {authenticate as defaultAuthenticate, requirePermission as defaultRequirePermission} from '../../middleware/auth.js';
+import {getEntry, listEntries} from '../../services/collections.js';
+import {readableContactIds} from '../../services/hooks.js';
+import {getPermissionsFor} from '../../services/roles.js';
+import {getEffectiveRoles} from '../../services/userRoles.js';
+import {isToolEnabled} from '../../services/tools.js';
+import {mountCallRoutes} from '../../../plugins/_lib/call/routes.js';
+import {getBaseUrl} from '../public.js';
+import {
+    EMAIL_RE, callMailReady, callPaths, callsOfContact, createCall, getCall, instantCallsEnabled, isOpen,
+    mayEmailAddress, mayStartCall, sendCallEmail, whoIsCalling
+} from '../../services/instantCalls.js';
+
+const CONTACTS_SLUG = 'contacts-contacts';
+
+/**
+ * @param {import('fastify').FastifyInstance} fastify
+ * @param {{authenticate?: Function, requirePermission?: Function, isEnabled?: () => boolean, rooms?: object}} [opts] - injectable for tests
+ */
+export async function callsRoutes(fastify, opts = {}) {
+    const authenticate = opts.authenticate || defaultAuthenticate;
+    const requirePermission = opts.requirePermission || defaultRequirePermission;
+    const isEnabled = opts.isEnabled || instantCallsEnabled;
+    const can = (action) => ({preHandler: [authenticate, requirePermission('calls', action)]});
+    const uidOf = (request) => String(request.user?.id ?? request.user?.sub ?? '');
+    const hostNameOf = (request) => String(request.user?.name || request.user?.email || '').trim();
+    const fail = (reply, status, error, extra = {}) => reply.code(status).send({error, ...extra});
+    const viewerOf = (request) => ({id: uidOf(request), roles: getEffectiveRoles(request.user || {})});
+    /** Contacts on, and a role that may read them. */
+    const mayReadContacts = (viewer) => isToolEnabled('contacts')
+        && viewer.roles.some(r => getPermissionsFor('contacts', 'read').includes(r));
+    const shape = (e) => ({id: e.id, name: String(e.data?.name || ''), email: String(e.data?.email || '')});
+
+    // No Pro Tool with calls: nothing here exists.
+    fastify.addHook('onRequest', async (request, reply) => {
+        if (!isEnabled()) return reply.code(404).send({error: 'Not found'});
+    });
+
+    /** One contact the caller may read, or null (Contacts off, not readable, gone). */
+    async function readableContact(id, viewer) {
+        if (!id || !viewer.id || !mayReadContacts(viewer)) return null;
+        const e = await getEntry(CONTACTS_SLUG, String(id)).catch(() => null);
+        if (!e || !(await readableContactIds([e], viewer)).has(e.id)) return null;
+        return {...shape(e), mine: e.data?.userId === viewer.id};
+    }
+
+    fastify.get('/status', can('create'), async (request, reply) => {
+        return reply.send({mailReady: callMailReady(), contacts: mayReadContacts(viewerOf(request))});
+    });
+
+    fastify.get('/contacts', can('create'), async (request, reply) => {
+        const viewer = viewerOf(request);
+        if (!mayReadContacts(viewer)) return fail(reply, 403, 'Contacts are not available to you.');
+        const q = String(request.query?.q || '').trim().toLowerCase().slice(0, 100);
+        if (q.length < 2) return reply.send([]);
+        const {entries} = await listEntries(CONTACTS_SLUG, {limit: 100000}).catch(() => ({entries: []}));
+        const hits = (entries || []).filter(e => [e.data?.name, e.data?.email, e.data?.phone]
+            .some(v => String(v || '').toLowerCase().includes(q)));
+        const ok = await readableContactIds(hits, viewer);
+        const out = hits.filter(e => ok.has(e.id)).map(e => ({...shape(e), mine: e.data?.userId === viewer.id}))
+            .sort((a, b) => Number(b.mine) - Number(a.mine) || a.name.localeCompare(b.name)).slice(0, 20);
+        return reply.send(out);
+    });
+
+    fastify.get('/contact/:id', can('create'), async (request, reply) => {
+        const c = await readableContact(String(request.params.id), viewerOf(request));
+        if (!c) return fail(reply, 404, 'That contact could not be found.');
+        return reply.send(c);
+    });
+
+    fastify.post('/', {...can('create'), config: {rateLimit: {max: 20, timeWindow: '1 minute'}}}, async (request, reply) => {
+        const body = request.body || {};
+        const name = String(body.name || '').trim().slice(0, 120);
+        const email = String(body.email || '').trim().toLowerCase().slice(0, 200);
+        if (email && !EMAIL_RE.test(email)) return fail(reply, 400, 'That email address does not look right.', {errors: {email: 'That email address does not look right.'}});
+        if (body.notify === true && !email) return fail(reply, 400, 'An email address, to send them the link.', {errors: {email: 'An email address, to send them the link.'}});
+        const viewer = viewerOf(request);
+        if (!mayStartCall(viewer.id)) return fail(reply, 429, 'That is a lot of calls in a minute - wait a moment and try again.');
+        const contact = body.contactId ? await readableContact(String(body.contactId), viewer) : null;
+        const rec = await createCall({name, email, contactId: contact?.id || '', hostId: viewer.id, hostName: hostNameOf(request)});
+        const paths = callPaths(rec);
+        const joinUrl = `${getBaseUrl(request)}${paths.join}`;
+        let emailed = false;
+        let emailLimited = false;
+        if (body.notify === true && email) {
+            if (mayEmailAddress(email)) emailed = await sendCallEmail({to: email, name, hostName: rec.hostName, joinUrl}, {log: request.log});
+            else emailLimited = true;
+        }
+        return reply.code(201).send({id: rec.id, hostUrl: paths.host, joinUrl, emailed: emailed === true,
+            ...(emailLimited ? {emailLimited: true} : {}), expiresAt: rec.expiresAt});
+    });
+
+    fastify.get('/', can('read'), async (request, reply) => {
+        const contact = String(request.query?.contact || '');
+        if (!contact) return fail(reply, 400, 'contact is required');
+        const now = Date.now();
+        const list = (await callsOfContact(contact, uidOf(request))).slice(0, 20)
+            .map(c => ({id: c.id, name: c.name, createdAt: c.createdAt, expiresAt: c.expiresAt, open: isOpen(c, now)}));
+        return reply.send(list);
+    });
+
+    // The call engine: a room per call, guests knock, the host lets them in, open createdAt..expiresAt.
+    mountCallRoutes(fastify, {
+        prefix: '/room', ns: 'instant', ...(opts.rooms ? {rooms: opts.rooms} : {}),
+        resolve: async (request, room, body) => whoIsCalling(await getCall(String(room)), {t: body?.t, h: body?.h})
+    });
+}

package/server/routes/call-public.js

@@ -0,0 +1,104 @@
+/**
+ * An instant call's page (services/instantCalls.js), in the site's own shell:
+ *
+ *   /_call/<id>?t=<guest token>   the person called
+ *   /_call/<id>?h=<host key>      the host
+ *
+ * Under `/_call`, like `/_preview`. Answered from an onRequest hook, and ONLY
+ * while instant calls are on: with no Pro Tool with calls the request goes on
+ * to the normal page handling, so the path is never claimed on a free site.
+ * The link is checked here only to choose between the call and a short note;
+ * the call's join checks it again, and the time.
+ *
+ * The credential is in the URL, so: no referrer, no caching, no indexing, and
+ * the page is rendered WITHOUT the site's and plugins' injected head/body
+ * snippets or the analytics beacon (renderBlogPage `injection: false`) - no
+ * third-party script sees `?h=`. call.js then takes the credentials out of the
+ * address bar (keeping them in sessionStorage for this tab), and a reload of
+ * the bare address comes back to them through the small script on the "not
+ * valid" page (`recoverScript`).
+ *
+ * @module routes/call-public
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {renderBlogPage} from '../services/renderer.js';
+import {getBaseUrl} from './public.js';
+import {CALL_PATH, ROOM_API, getCall, instantCallsEnabled, whoIsCalling} from '../services/instantCalls.js';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const TEMPLATE = path.join(HERE, '..', 'templates', 'call.html');
+const ASSET_V = (() => {
+    try { return JSON.parse(fs.readFileSync(path.join(HERE, '..', '..', 'package.json'), 'utf8')).version || '1'; } catch { return '1'; }
+})();
+
+export const esc = (s) => String(s ?? '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#39;');
+
+/**
+ * The page's body and status: the call (200), "not valid" (404) or "ended" (410).
+ *
+ * @param {object|null} rec
+ * @param {object|null} who - whoIsCalling(rec, cred)
+ * @param {{t?: string, h?: string}} cred
+ */
+/**
+ * On the "not valid" page of a bare `/_call/<id>` (no credentials in the
+ * address): this tab's call page stripped them (call.js) - go back to it with them.
+ * A wrong credential always has a query string, so this cannot loop.
+ */
+export const recoverScript = '<script>(function(){try{if(location.search)return;'
+    + 'var s=sessionStorage.getItem("dm-call:"+location.pathname);'
+    + 'if(s&&s.charAt(0)==="?")location.replace(location.pathname+s);}catch(e){}})();</script>';
+
+export function callPage(rec, who, cred, now = Date.now()) {
+    if (!rec || !who) {
+        const bare = !cred?.t && !cred?.h;
+        return {status: 404, title: 'Call', body: '<h1>This call link is not valid</h1><p>Ask the person who sent it for a new one.</p>'
+            + (bare ? recoverScript : '')};
+    }
+    if (!(Date.parse(rec.expiresAt) > now)) {
+        return {status: 410, title: 'Call', body: '<h1>This call has ended</h1><p>Ask the person who sent the link for a new one.</p>'};
+    }
+    const cfg = {api: ROOM_API, room: rec.id, cred, title: who.title, askName: !who.host && !rec.name, recordingAllowed: false, closesAt: rec.expiresAt};
+    return {
+        status: 200,
+        title: who.title,
+        body: `<link rel="stylesheet" href="/plugins/_lib/public/call/call.css?v=${esc(ASSET_V)}">`
+            + `<div data-dm-call='${esc(JSON.stringify(cfg))}'><noscript><p>The call needs JavaScript switched on.</p></noscript></div>`
+            + `<script type="module" src="/plugins/_lib/public/call/call.js?v=${esc(ASSET_V)}"></script>`
+    };
+}
+
+/**
+ * @param {import('fastify').FastifyInstance} fastify
+ * @param {{isEnabled?: () => boolean}} [opts]
+ */
+export async function callPublicRoutes(fastify, opts = {}) {
+    const isEnabled = opts.isEnabled || instantCallsEnabled;
+    const PREFIX = `${CALL_PATH}/`;
+
+    fastify.addHook('onRequest', async (request, reply) => {
+        if (request.method !== 'GET' && request.method !== 'HEAD') return;
+        const [pathname, search = ''] = String(request.url || '').split('?');
+        if (!pathname.startsWith(PREFIX) || !isEnabled()) return;
+        let id = '';
+        try { id = decodeURIComponent(pathname.slice(PREFIX.length)).slice(0, 64); } catch { return; }
+        if (!id || id.includes('/')) return;
+        reply.header('referrer-policy', 'no-referrer');
+        reply.header('cache-control', 'no-store, private');
+        reply.header('x-robots-tag', 'noindex, nofollow');
+        const q = new URLSearchParams(search);
+        const cred = q.get('h') ? {h: q.get('h').slice(0, 128)} : {t: String(q.get('t') || '').slice(0, 128)};
+        const rec = await getCall(id);
+        const page = callPage(rec, whoIsCalling(rec, cred), cred);
+        const html = await renderBlogPage(TEMPLATE, {body: page.body}, {
+            title: page.title, urlPath: `${CALL_PATH}/${encodeURIComponent(id)}`, noindex: true, baseUrl: getBaseUrl(request),
+            injection: false
+        });
+        return reply.code(page.status).type('text/html; charset=utf-8').send(html);
+    });
+}
+
+// The onRequest hook must see every request, not only routes registered here (it registers none).
+callPublicRoutes[Symbol.for('skip-override')] = true;

package/server/server.js

@@ -579,6 +579,12 @@ await app.register(toolGate('seo', seoRoutes), {prefix: '/api/seo'});
 await app.register(toolsRoutes, {prefix: '/api'});
 // What plugins show beside a contact or a note (Calendar's Events) - 0.79.
 await app.register(relatedRoutes, {prefix: '/api/related'});
+// Instant calls ("Call Sam now…") - core code, switched on only by a Pro Tool with calls
+// (hooks.enableInstantCalls, services/instantCalls.js); 404 on every route until then.
+{
+    const {callsRoutes} = await import('./routes/api/calls.js');
+    await app.register(callsRoutes, {prefix: '/api/calls'});
+}
 
 // ---------------------------------------------------------------------------
 // CMS Plugins (server-side Fastify plugins from plugins/ directory)
@@ -702,6 +708,9 @@ for (const [name, plugin] of Object.entries(getLoadedPlugins())) {
 // out-prioritises the catch-all; must be registered before it.
 const { docsPublicRoutes } = await import('./routes/docs-public.js');
 await app.register(docsPublicRoutes);
+// An instant call's page, /_call/<id> (a reserved prefix, like /_preview) - before the catch-all.
+const { callPublicRoutes } = await import('./routes/call-public.js');
+await app.register(callPublicRoutes);
 
 const { publicRoutes } = await import('./routes/public.js');
 await app.register(publicRoutes);

package/server/services/hooks.js

@@ -299,9 +299,12 @@ const _relatedProviders = new Map(); // kind -> Map(id -> provider)
  * `actions` are shown in the record's menu, `{id}` in a url replaced by the
  * record's id: `[{label, icon?, url, permission?}]`. `permission`
  * (`{resource, action}`) shows the action only to roles that hold it.
+ * `when` (optional, `() => boolean`) is asked on every request: a provider that
+ * answers false is left out for now (its actions and its list) - core's instant
+ * calls stand aside that way while an older Booking Pro registers its own.
  *
  * @param {'contact'|'note'|'message'} kind
- * @param {{id: string, label: string, icon?: string, list: Function, actions?: object[], owner?: string}} provider
+ * @param {{id: string, label: string, icon?: string, list: Function, actions?: object[], owner?: string, when?: Function}} provider
  * @returns {boolean}
  */
 export function registerRelatedItems(kind, provider = {}) {
@@ -326,11 +329,17 @@ export function registerRelatedItems(kind, provider = {}) {
     icon: typeof provider.icon === 'string' ? provider.icon : 'link',
     owner: typeof provider.owner === 'string' ? provider.owner : 'core',
     actions,
-    list: typeof list === 'function' ? list : () => []
+    list: typeof list === 'function' ? list : () => [],
+    ...(typeof provider.when === 'function' ? {when: provider.when} : {})
   });
   return true;
 }
 
+/** Is a provider with this id registered for this kind (whatever its `when` says)? */
+export function hasRelatedProvider(kind, id) {
+  return Boolean(_relatedProviders.get(kind)?.has(id));
+}
+
 /** @param {string} kind @param {string} id */
 export function unregisterRelatedItems(kind, id) {
   _relatedProviders.get(kind)?.delete(id);
@@ -338,7 +347,61 @@ export function unregisterRelatedItems(kind, id) {
 
 /** The providers for one kind of record. */
 export function getRelatedProviders(kind) {
-  return [...(_relatedProviders.get(kind)?.values() ?? [])];
+  return [...(_relatedProviders.get(kind)?.values() ?? [])].filter((p) => {
+    try { return !p.when || p.when() !== false; } catch { return true; }
+  });
+}
+
+// ---------------------------------------------------------------------------
+// 7b. Contact read access - who may read a contact that is not their own
+// ---------------------------------------------------------------------------
+//
+// Core Contacts are per user: only the owner reads one. A plugin that shares
+// contacts (Contacts Pro) registers the rule it enforces itself, so core code
+// that takes a contact id (instant calls) accepts exactly the contacts the
+// caller may read, without reimplementing the plugin's rule.
+
+const _contactAccess = new Map(); // owner -> fn(entries, viewer) => Promise<Iterable<id>>
+
+/**
+ * @param {string} owner - the plugin
+ * @param {(entries: object[], viewer: {id: string, roles: string[]}) => Promise<Iterable<string>>} fn
+ *   of the collection entries given (contacts-contacts, not the viewer's own), the ids the viewer may READ
+ */
+export function registerContactAccess(owner, fn) {
+  if (typeof owner !== 'string' || !owner || typeof fn !== 'function') return false;
+  _contactAccess.set(owner, fn);
+  return true;
+}
+
+/** @param {string} owner */
+export function unregisterContactAccess(owner) {
+  _contactAccess.delete(owner);
+}
+
+/**
+ * Which of these contact entries may the viewer read? Their own, plus whatever
+ * a registered rule allows. A rule that throws allows nothing.
+ *
+ * @param {object[]} entries - contacts-contacts entries
+ * @param {{id: string, roles?: string[]}} viewer
+ * @returns {Promise<Set<string>>} entry ids
+ */
+export async function readableContactIds(entries, viewer) {
+  const out = new Set();
+  if (!viewer?.id) return out;
+  const others = [];
+  for (const e of entries || []) {
+    if (e?.data?.userId === viewer.id) out.add(e.id);
+    else if (e) others.push(e);
+  }
+  if (!others.length) return out;
+  for (const fn of _contactAccess.values()) {
+    try {
+      for (const id of (await fn(others, {id: viewer.id, roles: viewer.roles || []})) || []) out.add(String(id));
+    } catch { /* a failing rule grants nothing */ }
+  }
+  return out;
 }
 
 // ---------------------------------------------------------------------------